Sample output from the SuiteScript Risk & Technical-Debt Inventory prompt in the Sonar AI Prompt Library, run against a NetSuite test account. Every name and number here is test data. Back to the post · The library

⚙️ SuiteScript Risk Inventory & Remediation Plan v2 — evidence-enriched

Account-wide scan · 8 Aug 2026 · SuiteQL over script / scriptdeployment / file / scriptnote / paymentevent / paymentprocessingprofile + source inspection · Full 421-row raw data in companion CSV ss10-full-appendix.csv

1 · Account at a Glance

781
Total scripts
421
SuiteScript 1.0 (54%)
92
1.0 w/ no active deployment
13
Plug-in scripts (all 1.0)
4
Scripts w/ logged errors
81
On SuiteScript 2.1

API version mix

54% on deprecated 1.0
1.0 — 421 2.0 — 279 2.1 — 81

Risk matrix — break likelihood × reconstruction difficulty

Reconstruction difficulty → Break likelihood → SOLUPAY CELIGO -DE PrefForm 92 undeployed ITR plug-ins SDG bundles Ownership hygiene
CriticalHighMediumLow · bubble size = scripts affected

2 · New Evidence (v2)

🔎 Solupay is NOT decommissioned. Payment processing profile id 1 — "Solupay" is active (inactive = F) but running in test mode (testmode = T), with 26 gateway events, most recent 23 Aug 2026. The user event Solupay External Payments 2.0 (script 436) is still deployed on INVOICE and SALESORDER, and the gateway plug-in customscript_solupaysuitepayments deployment is RELEASED. Meanwhile ~45 of its 53 satellite scripts are undeployed. Verdict: a half-live integration in test mode — the worst of both worlds. Someone paused a migration mid-flight; nobody finished it. (The other 20,410 payment events in 2026 are internal MIMIC-mode events, not Solupay traffic.)
✅ Runtime error logs are quiet. The entire scriptnote retention window shows errors on only 4 scripts: Item Substitute Transactions UE (2.0 — 6 errors), Celigo Realtime Export Data Flow Runner (1.0 — 1 error), and two internal tools. Interpretation: the risk in this account is latent, not active — nothing is currently on fire, which is exactly the window in which migration is cheap. After a release breaks something, the same work is done at incident-pricing.
✅ Trigger map for the in-house script. -DE Set Preferred Form SL (Suitelet) is RELEASED and deployed; its companion client script's deployment is inactive — consistent with it being served through the Suitelet page. Blast radius on failure: the bulk preferred-form utility page only; no transaction-save path.

3 · Where the 421 SuiteScript 1.0 Scripts Live

ClusterCountNatureActively deployed?
NetSuite / SuiteApp bundles (Electronic Payments, Intl Tax Reports, Tax Audit Files, SCM, NO-SAFT, Campaign Assistant…)~255Vendor-maintained bundle codeMostly yes (TAF Transaction UE: 18 deploys, Tax Transaction Fields UE: 11)
Celigo Integrator v1 stack56Closure-minified builds 8 KB–1.07 MBYes — batch manager 103 deploys, runner 100
Solupay / Nuvei SuitePayments531 MB minified gateway + tokenization UI~8 of 53 — half-live, test mode (see Evidence)
SDG-installed bundles (APM ×39, LSA, Subsidiary Navigator, ESC)~55NetSuite-authored 1.0 SuiteletsYes
True in-house customcustomscript_de_set_preferred_form_cs/_sl2Hand-written 2018 SS1.0SL yes; CS inactive

4 · Plug-in Implementations (all API 1.0)

ScriptScript IDTypeSizeRisk note
Solupay SuitePaymentcustomscript_solupaysuitepaymentsPAYMENTGATEWAY1.05 MB min.Live profile, test mode — see Issue #1
DemoPaymentPlugincustomscript_demo_payment_pluginPAYMENTGATEWAY3.8 KBDemo profile #2 — candidate for removal
Supplementary Tax Calculationcustomscript_supp_tax_calcCUSTOMGLLINES1.2 KBGL impact — bundle-managed
Supplementary Report + Validator + MX UUIDcustomscript_supplementary_report et al.PLUGINTYPE ×30.06–104 KBITR bundle plug-in contracts
ID / PH / TH / TR / VN Supplementary Reports, Form Validation, Online Submissioncustomscript_supplementary_id/_ph/_th/_tr/_vn, customscript_form, customscript_online_submissionPLUGINTYPEIMPL ×71.5–67 KBStatutory VAT filing path — regression-test at each release

5 · Ranked Issues

Break risk = likelihood a semi-annual NetSuite release or vendor EOL disables it · Reconstruction difficulty = recoverability of intent from in-account artifacts · $150/hr blended rate

#1 Solupay/Nuvei gateway — half-live, test-mode, 1 MB minified, on the money path CRITICAL

Scripts53 (8 deployed / 45 not)
Break riskVery high — abandoned mid-migration; SS1.0 gateway plug-in; vendor absorbed by Nuvei
ReconstructionNear-impossible — 1,046,573 B minified plug-in; logic split across 52 satellites
EvidenceProfile active + testmode=T; events through 23 Aug 2026; UE live on Invoice & Sales Order

60–100 hrs · $9,000–$15,000 (forward path) · ~16 hrs / $2,400 (decommission)

#2 Celigo Integrator v1 — 56 SS1.0 scripts, 200+ deployments, minified vendor builds CRITICAL

Scripts56
Break riskHigh — deprecated generation; shared 1.07 MB build file = single point of failure across dozens of scripts
ReconstructionImpossible from source; only from integrator.io flow configs
Evidence1 logged runtime error (realtime export runner) — early smoke

40–80 hrs · $6,000–$12,000

#3 In-house -DE Set Preferred Form — SS1.0, raw XHR, DOM scraping HIGH

Scripts2 (Suitelet live, CS inactive)
Break riskHigh — document.getElementById('sdt_report__label') + hand-rolled AJAX breaks on UI markup changes
ReconstructionModerate-low — readable, versioned header (v1.00, Jan 2018, "fteves"), clear function names
Blast radiusBulk preferred-form utility only; silent failure mode

Rewrite as SS2.1 Suitelet + Map/Reduce; kill the client-side automation loop entirely.

16–24 hrs · $2,400–$3,600

#4 92 undeployed 1.0 scripts — unknown intent, some dangerous HIGH

Scripts92 (45 Solupay, 5 Celigo, ~37 bundle, incl. Record Eradicator / Item Mass Updater / DataWizard bulk tools)
Break riskIndirect — audit poison + casual-redeploy hazard

One-pass disposition review: tag each retire vs keep-dormant, inactivate the retired, document the kept.

12–20 hrs · $1,800–$3,000

#5 ITR plug-in implementations — statutory compliance on 1.0 MEDIUM

7 country VAT report implementations + GL-impact plug-in, bundle-managed but compliance-critical. Confirm which countries Finance files, verify bundle currency, add to release-preview regression list.

8–16 hrs · $1,200–$2,400

#6 SDG bundles — APM/LSA/SubNav/ESC on 1.0 MEDIUM

~55 NetSuite-authored scripts; LSA's 57 KB UE fires on every communication record. Update bundles; uninstall SubNav/ESC if unused.

8–12 hrs · $1,200–$1,800

#7 Ownership register + failure notifications LOW / HYGIENE

Owners are installers; no notifyemails on 1.0 scripts, so failures alert no one. Set notify aliases; record purpose in description fields (blank today).

6–8 hrs · $900–$1,200

6 · Remediation Roadmap

Week 1–2 · Decide & document
Solupay go/kill decision with Treasury · export Celigo flow definitions · start disposition review of 92 undeployed scripts
Admin + Finance stakeholder · ~20 hrs
Week 3–6 · Vendor coordination
Nuvei plug-in migration (or decommission) · Celigo SuiteApp update scheduled with vendor · SDG bundle updates applied in sandbox
Developer + vendors · ~60–110 hrs
Week 7–8 · In-house rewrite
-DE Set Preferred Form → SS2.1 · ownership register + notify emails · ITR regression checklist written
Developer · ~30 hrs
Ongoing · Release discipline
Run regression checklist (payments, top-5 Celigo flows, ITR filings) against each Release Preview account
Admin · ~8 hrs per release

7 · Cost Summary

150 – 260 hours · $22,500 – $39,000

Midpoint ≈ 205 hrs / $30,750. The Solupay decision is the biggest swing factor (−$12K if decommissioned). Error logs confirm nothing is failing yet — this is preventive-pricing, not incident-pricing.

#IssueSeverityHoursCost
1Solupay/Nuvei: complete or kill the migrationCRITICAL60–100$9,000–$15,000
2Celigo v1 → supported SuiteApp + flow docsCRITICAL40–80$6,000–$12,000
3-DE Set Preferred Form SS2.1 rewriteHIGH16–24$2,400–$3,600
4Disposition of 92 undeployed scriptsHIGH12–20$1,800–$3,000
5ITR plug-in verification + regression listMEDIUM8–16$1,200–$2,400
6SDG bundle update / uninstallMEDIUM8–12$1,200–$1,800
7Ownership register + notificationsLOW6–8$900–$1,200

8 · Interactive Appendix — key SS1.0 scripts

Filter by name/type/owner. This table holds the 60 highest-signal scripts (user-owned + most-deployed bundle scripts); the complete 421-row dataset is in ss10-full-appendix.csv.

NameTypeOwnerSize (B)Active deploys
Methodology v2: full script enumeration (781) joined to file + scriptdeployment; runtime errors from scriptnote; gateway liveness from paymentprocessingprofile + paymentevent (20,440 events in 2026, of which 26 on the Solupay profile); source inspection via file-cabinet grep. Costs at $150/hr blended; vendor fees excluded. Companion raw data: ss10-full-appendix.csv (421 rows). Generated by Sonar AI, 8 Aug 2026.